SecureWorks August 2019

DanBot can upload files from compromised hosts.

HEXANE has used a PowerShell-based keylogging tool to capture the window title.

HEXANE has used remote desktop sessions for lateral movement.

DanBot can Base64 encode its payload.

DanBot can use a scheduled task for installation.

HEXANE has used a PowerShell-based keylogger named `kl.ps1`.

HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.

DanBot has the ability to execute arbitrary commands via `cmd.exe`.

DanBot can use a VBA macro embedded in an Excel file to drop the payload.

DanBot can use HTTP in C2 communication.

DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications.

Empire can acquire local and domain user account information.

DanBot can download additional files to a targeted system.

HEXANE has used brute force attacks to compromise valid credentials.

HEXANE has used password spraying attacks to obtain valid credentials.

DanBot can use a VBA macro to decode its payload prior to installation and execution.

HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.

DanBot has relied on victims' opening a malicious file for initial execution.

HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.

PoshC2 can decrypt passwords stored in the RDCMan configuration file.

DanBot has been distributed within a malicious Excel attachment via spearphishing emails.

HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.

HEXANE has used compromised accounts to send spearphishing emails.

HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.

HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.

HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.